You may have already tried this (https://megalytic.com/blog/how-to-filter-out-fake-referrals-and-other-google-analytics-spam) as I believe it is one of the more common articles, but it suggests setting up a filter to use hostnames and testing it with a segment. This has worked well for us. You have to be careful and make sure you use ALL the relevant hostnames and that your expression doesn't contain errors.